Honestly youcan audit.

Security is the product

Aurexis sells honesty, and honesty is only worth what it can be trusted to be. The guarantees are built into how the engine runs, so they survive every future change.

Your source code is never stored

We keep only artefact hashes - compact fingerprints of the output. A record stays fully verifiable because anyone can re-hash the artefact and compare, without us ever holding your code. This is invariant I5.

Your code is never executed

To produce a security score, we inspect your code and its dependency tree statically. Nothing of yours is ever run on our side to generate a number.

Real scanners, real findings

Scores come from actual tools run against the real build:

• Dependency audit - known-vulnerable packages in your tree.
• Secrets scan - credentials or keys accidentally committed.
• Static analysis - code-level issues, found without running the code.

If the audit does not clear the bar, the run halts and says so.

Deploy is gated on security

A deploy is promoted only when the audit clears and the URL is verified reachable. A halt is a result, never a failure hidden behind a green badge.

Encryption

Encrypted in transit with modern TLS and at rest. Secrets and tokens live in a dedicated secrets manager, not in application databases.

Authentication and access

Sign in with Google, GitHub or GitLab, or a passwordless email link. Internally, access to production and customer data is least-privilege, logged and reviewed.

Sealed and tamper-evident records

Every verdict is sealed and hashed the moment it is made. Because the hash is part of the record, any later change would be detectable.

Isolation

Your inputs and records are isolated to your account, never exposed to other users, and never used to train models that serve anyone else.

Responsible disclosure

Found a vulnerability? Tell us at security@aurexis.app before disclosing publicly. We welcome good-faith research and will keep you updated through the fix.